# Review restic retention groups before counting snapshots to keep

> Calculate retention against the selected host, path, and tag groups before enabling removal.

- Canonical URL: https://update.dsesecurity.com/updates/review-restic-retention-groups-before-counting-snapshots-to-keep/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:11+00:00
- Modified: 2026-10-15T13:36:16+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Calculate retention against the selected host, path, and tag groups before enabling removal.

## Potentially affected

This applies to the stable restic forget policy documented here. It addresses snapshot selection and grouping, rather than the separate space-reclamation behavior of prune or Proxmox garbage collection.

## DSE recommendation

DSE recommends making an example inventory part of every retention-policy review.

## Article

Calculate retention against the selected host, path, and tag groups before enabling removal.

## Source facts

Restic forget applies policy separately to snapshot groups, which by default are based on hostname and backed-up paths. The group-by option can change that grouping or disable it with an empty value. Tag filtering has its own logic: comma-separated tags in one argument require all those tags, while repeated tag arguments are combined as alternatives. A keep-last count therefore cannot be interpreted correctly without knowing both the selected snapshot set and the grouping used for policy application.

Source: [restic — Removing Backup Snapshots](https://restic.readthedocs.io/en/stable/060_forget.html).

## Applicability

This applies to the stable restic forget policy documented here. It addresses snapshot selection and grouping, rather than the separate space-reclamation behavior of prune or Proxmox garbage collection.

## DSE recommendation

DSE recommends making an example inventory part of every retention-policy review. Include more than one host, a changed source-path set, and the actual tag combinations used by automation. State whether the desired count applies independently to each group or across the selected set. Keep filtering and keeping rules visible together so reviewers do not approve a number without seeing what it counts. Preserve a preview of removals before any scheduled policy begins affecting production history.

## Verification

On disposable snapshots, run a policy preview with the intended host, path, tag, and grouping options. Compare retained snapshots with a manually calculated inventory. Include a changed-path or renamed-host case, and retain the final command and review evidence before enabling automated removal.

## Official reference

[restic — Removing Backup Snapshots](https://restic.readthedocs.io/en/stable/060_forget.html). Reviewed October 15, 2026.

## Primary reference

- Name: restic — Removing Backup Snapshots
- Authority: restic.readthedocs.io
- URL: https://restic.readthedocs.io/en/stable/060_forget.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Review restic retention groups before counting snapshots to keep,” DSE Security, https://update.dsesecurity.com/updates/review-restic-retention-groups-before-counting-snapshots-to-keep/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.